Require Bitlocker

RASH MAAR 421 Reputation points
2020-08-24T14:04:12.013+00:00

Hi,

Is there a way to force users to activate Bitlocker?
I created a profile and set Require under Encrypt devices,
And it only gives a one-time alert to the user and does not require him to activate the Bitlocker.

Thanks
Rash

Microsoft Intune Configuration
Microsoft Intune Configuration
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Configuration: The process of arranging or setting up computer systems, hardware, or software.
1,783 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,657 questions
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jason Sandys 31,186 Reputation points Microsoft Employee
    2020-08-24T14:56:52.58+00:00

    Use conditional access and a compliance policy that requires device encryption.

    Also, review https://msendpointmgr.com/2019/10/31/silently-enable-bitlocker-for-hybrid-azure-ad-joined-devices-using-windows-autopilot/ to see how to enable it silently.

    1 person found this answer helpful.
  2. CiciWu-MSFT 1,206 Reputation points
    2020-08-25T03:04:03.483+00:00

    Exactly. If you set BitLocker CSP: RequireDeviceEncryption, it will only prompt users to enable device encryption. As a workaround, you can set a conditional access policy and require Bitlocker for Encrypt devices. If not, device will mark as Not compatible as cannot access corporate resource.

    If the response is helpful, please click "Accept Answer" and upvote it.

    0 comments
  3. MTG Marinetechnik 356 Reputation points
    2020-08-26T09:22:27.77+00:00

    I would not fondle with complicated policies but instead use a script that informs the user about his (random) PIN and starts the encryption automatically. Would that be alright with you? Then I show you the script.

    0 comments
  4. Ola Ström 1 Reputation point MVP
    2020-08-27T10:55:01.247+00:00

    Knowing that users will not act on an alert about encrypting their disk, I would go with a silent script. Using Conditional Access and Compliance Policies are always nice, but it will just generate more support since users will have no clue why they can't access corporate data suddenly.

    Keep it simple and use a scripts like the ones mentioned earlier by Jason, that's the approach I would use (and seen in action). https://msendpointmgr.com/2019/10/31/silently-enable-bitlocker-for-hybrid-azure-ad-joined-devices-using-windows-autopilot